Cookie Lock

This modules provides a simple way to lock your site down using a single username and password. The initial goal was to prevent search engines and clients from viewing sites that are under active development. Once enabled and configured you cannot browse to any pages on the site other than the Cookie Lock page.

Your Drupal session isn't affected by this module. This means you can lock your site down, but still allow anonymous user testing (provided they entered proper credentials).

Though cookies are an important part of the module, please don't let that steer you away from installing. The cookie is only used to store the generic credentials so the user doesn't have to retype it every time they access the site. Users without cookies enabled cannot bypass the authentication.

Setup is simple: Enable the module, browse to the configuration page (you must have "administer cookie lock" permissions), check the "Lock site" box and fill in the credentials, then save the form. At this point you, yourself, will have to enter the credentials to access anything on the site. The authentication form is simple, yet professional-looking. Important: test the lock to make sure it's working as expected (I recommend using a different browser or your browser's private/incognito mode to attempt to visit the homepage of the site in a fresh session).

Cache warning!: cache_clear_all() will be called automatically when you enable the module. On some sites, however, you may need to manually clear your caches after enabling, disabling, or manually locking/unlocking via "Locked yourself out?" instructions below.

How does the authentication work? The password you enter on the settings form will be stored as an md5 hash. When the user attempts to authenticate, the username they entered must match the stored username in the database, and the password they entered (which we md5-hash on submit) must also match the md5-hashed stored password. Regarding md5: this isn't meant to be super-secure. I just didn't want the passwords to be stored in plain text.

A word of caution: the username and md5-hashed password will be visible to users who are granted access (if they know how to view their cookies). For this reason, choose a username and password that are not personal or associated with any of the Drupal user accounts on the site.

Locked yourself out? You have a few options.

• Disable the module, or
• OR alter variables in the database variable table:
  • Delete the cookielock_islocked variable
  • OR set the cookielock_islocked variable to 0
  • OR delete (or set as empty or desired string) the cookielock_username variable
  • OR delete (or set as empty or md5-hashed string) the cookielock_password variable

Need unrestricted access for API testing or convenience? You can add as many unrestricted IP addresses as you need, though I recommend using this sparingly. I added this feature because I needed to allow a 3rd party system to connect to a service on my site without any restrictions.